What is Common Name (CN) in our SSL certificate?
In our CSR/certificate, the Common Name, also known as CN, represents the server name (FQDN¹) protected by the SSL certificate. Note that the certificate is valid only for the exact FQDN (mentioned as CN) indicated in our CSR/certificate. SSL certificates are specific to the Common Name that they have been issued for at the host level. The Common Name must be the same as the Web address we access when connecting to a secure site.
The Common Name field is often misinterpreted and filled out incorrectly with our organization’s actual name. Most web browsers display a warning message (“host name mismatch error”) when connecting to an address that does not match the common name in the certificate. The Common Name is technically represented by the commonName field in the X.509 certificate specification.
In the case of a single-name certificate, the Common Name consists of a single host name (e.g. example.com , www.example.com ), or a wildcard name in the case of a wildcard certificate (e.g. *.example.com ).
An SSL certificate activated with the CSR code generated for www.example.com will not cover security.example.com or any other subdomain of example.com. On the other hand, SSL activated with the CSR code generated for security.example.com will cover neither www.example.com nor example.com.
Common Name Format
The Common Name is not a URL. It doesn’t include any protocol (e.g. http:// or https://), port number, or pathname. For instance, https://example.com or example.com/path are incorrect. In both cases, the common name should be example.com .
Common Name is not mandatory
As far as X.509 is concerned, the Common Name is not mandatory.
Common Name vs. Subject Alternative Name
The Common Name can only contain up to one entry: either a wildcard or non-wildcard name. It’s not possible to specify a list of names covered by an SSL certificate in the common name field.
The Subject Alternative Name extension (also called Subject Alternate Name or SAN) was introduced to solve this limitation. The SAN allows the issuance of multi-name SSL certificates.
Что такое cn сертификата
а в httpd.conf
SSLCACertificateFile ssl/ca.crt
и только после этого все заработало.
А директива SSLRequire должна выглядеть как SSLRequireSSL.
Если можно расскажите как удалось авторизацию юзеров по сертификатам сделать? (что в каком порядке, если гайд есть буду прыгать от счастья) Что такое cn сертификатаDigiCert is the world’s premier provider of high-assurance digital certificates—providing trusted SSL, private and managed PKI deployments, and device certificates for the emerging IoT market. Since our founding almost fifteen years ago, we’ve been driven by the idea of finding a better way. A better way to provide authentication on the internet. A better way to tailor solutions to our customer’s needs. © 2022 DigiCert, Inc. All rights reserved. DigiCert and CertCentral are registered trademarks of DigiCert, Inc. in the USA and elsewhere. Other names may be trademarks of their respective owners. What is the SSL Certificate Common Name?The Common Name (AKA CN) represents the server name protected by the SSL certificate. The certificate is valid only if the request hostname matches the certificate common name. Most web browsers display a warning message when connecting to an address that does not match the common name in the certificate. In the case of a single-name certificate, the common name consists of a single host name (e.g. example.com , www.example.com ), or a wildcard name in case of a wildcard certificate (e.g. *.example.com ). The common name is technically represented by the commonName field in the X.509 certificate specification. commonName formatThe common name is not a URL. It doesn’t include any protocol (e.g. http:// or https://), port number, or pathname. For instance, https://example.com or example.com/path are incorrect. In both cases, the common name should be example.com . It must precisely match the server name where the certificate is installed. If the certificate is issued for a subdomain, it should be the full subdomain. For instance, for the www and api subdomains of example.com , the common name will be www.example.com or api.example.com , and not example.com . Single-name or Wildcard?Read the article Choosing the SSL Certificate Common Name for help determining the appropriate host names for your certificate. Example of host name mismatch error on Google Chrome
Example of host name mismatch error on Google Safari
Common Name vs Subject Alternative NameThe common name can only contain up to one entry: either a wildcard or non-wildcard name. It’s not possible to specify a list of names covered by an SSL certificate in the common name field. The Subject Alternative Name extension (also called Subject Alternate Name or SAN) was introduced to solve this limitation. The SAN allows issuance of multi-name SSL certificates. The ability to directly specify the content of a certificate SAN depends on the Certificate Authority and the specific product. Most certificate authorities have historically marketed multi-domain SSL certificates as a separate product. They’re generally charged at a higher rate than a standard single-name certificate. On the technical side, the SAN extension was introduced to integrate the common name. Since HTTPS was first introduced in 2000 (and defined by the RFC 2818), the use of the commonName field has been considered deprecated, because it’s ambiguous and untyped. The CA/Browser Forum has since mandated that the SAN would also include any value present in the common name, effectively making the SAN the only required reference for a certificate match with the server name. The notion of the common name survives mostly as a legacy of the past. There are active discussions to remove its use from most browsers and interfaces. Get Help From DevelopersEveryone at DNSimple enjoys writing support docs. | ||||
